A device driver attempting to corrupt the...

STOP: 0x000000C4

Windows in various situations checks each driver to be sure it's working correctly. This error indicates it found a fatal fault in the driver and it must be disabled or replaced.

Some versions of Windows may show the description as "DRIVER_VERIFIER_DETECTED_VIOLATION".

This is a fatal Windows error, typically called a Stop message, Bug Check, or more commonly the Blue Screen of Death (BSoD). The system is in a forced reboot state. Any unsaved work is likely lost.

Sample Screen

A problem has been detected and Windows has been shut down to prevent damage to your computer.

A device driver attempting to corrupt the system has been caught. The faulty driver currently on the kernel stack must be replaced with a working version.

If this is the first time you've seen this Stop error screen, restart your computer. If this screen appears again, follow these steps:

Check to make sure any new hardware or software is properly installed. If this is a new installation, ask your hardware or software manufacturer for any Windows updates you might need.

If problems continue, disable or remove any newly installed hardware or software. Disable BIOS memory options such as caching or shadowing. If you need to use Safe Mode to remove or disable components, restart your computer, press F8 to select Advanced Startup Options, and then select Safe Mode.

Technical Information:

*** STOP: 0x000000C4

Beginning dump of physical memory
Physical memory dump complete.

Contact your system administrator or technical support group for further
assistance.

Text may appear differently depending on where the error occurs.
Additional technical information (hex values) specific to a machine are not shown.

Key Facts

Full Title

A device driver attempting to corrupt the system has been caught. The faulty driver currently on the kernel stack must be replaced with a working version.

Check if you are using the latest hardware drivers, especially the chipset and video drivers. Older drivers are a common contributor to BSoD issues.

You can use a product like Driver Genius or Radar Sync to verify you have the latest drivers and help keep all your drivers up-to-date. If you're comfortable with driver installations, you can individually find and install current drivers.

The driver attempted to free pool at a bad address, or the driver passed invalid Parameters to a memory routine.

0x00000017

The driver attempted to free pool which contains an active ERESOURCE.

0x00000030

The driver passed an invalid Parameter to KeRaiseIrql (The Parameter was either a value lower than the current IRQL, or a value higher than HIGH_LEVEL. This may be the result of using an uninitialized Parameter.)

0x00000031

The driver passed an invalid Parameter to KeLowerIrql (The Parameter was either a value higher than the current IRQL, or a value higher than HIGH_LEVEL. This may be the result of using an uninitialized Parameter.)

0x00000032

The driver called KeReleaseSpinLock at an IRQL other than DISPATCH_LEVEL (This may be due to a double-release of a spin lock.)

0x00000033

The driver attempted to acquire fast mutex with IRQL > APC_LEVEL.

0x00000034

The driver attempted to release fast mutex at an IRQL other than APC_LEVEL.

0x00000035

The kernel released a spin lock with IRQL not equal to DISPATCH_LEVEL.

0x00000036

The kernel released a queued spin lock with IRQL not equal to DISPATCH_LEVEL.

0x00000037

The driver tried to acquire a resource, but APCs are not disabled.

0x00000038

The driver tried to release a resource, but APCs are not disabled.

0x00000039

The driver tried to acquire a mutex "unsafe" with IRQL not equal to APC_LEVEL on entry.

0x0000003A

The driver tried to release a mutex "unsafe" with IRQL not equal to APC_LEVEL on entry.

0x0000003B

The driver called KeWaitXxx with IRQL >= DISPATCH_LEVEL
(This is permitted only if the driver already owns the DISPATCHER lock and it passes a time-out value of zero to the routine.)

0x0000003C

The driver called ObReferenceObjectByHandle with a bad handle.

0x0000003D

The driver called ObReferenceObjectByHandle with a bad handle.

0x0000003E

The driver called KeLeaveCriticalRegion for a thread that is not currently in a critical region.

0x0000003F

The driver applied ObReferenceObject to an object that has a reference count of zero, or the driver applied ObDereferenceObject to an object that has a reference count of zero.

0x00000040

The driver called KeAcquireSpinLockAtDpcLevel with IRQL not equal to DISPATCH_LEVEL.

0x00000041

The driver called KeReleaseSpinLockFromDpcLevel with IRQL not equal to DISPATCH_LEVEL.

0x00000042

The driver called KeAcquireSpinLock with IRQL > DISPATCH_LEVEL.

0x00000051

The driver attempted to free memory after having written past the end of the allocation. A bug check with this Parameter occurs only when the Pool Tracking option of Driver Verifier is active.

0x00000052

The driver attempted to free memory after having written past the end of the allocation. A bug check with this Parameter occurs only when the Pool Tracking option of Driver Verifier is active.

0x00000053,
0x00000054,
or
0x00000059

The driver attempted to free memory after having written past the end of the allocation. A bug check with this Parameter occurs only when the Pool Tracking option of Driver Verifier is active.

0x00000060

The driver is unloading without first freeing its pool allocations. A bug check with this Parameter occurs only when the Pool Tracking option of Driver Verifier is active.

0x00000061

A driver thread is attempting to allocate pool memory while the driver is unloading. A bug check with this Parameter occurs only when the Pool Tracking option of Driver Verifier is active.

0x00000062

The driver is unloading without first freeing its pool allocations. A bug check with this Parameter occurs only when the Pool Tracking option of Driver Verifier is active.

0x0000006F

The driver passed a page to MmProbeAndLockPages that was not in the PFN database (This often results from a driver that attempts to lock its own private dualport RAM. Such behavior can corrupt memory on machines with noncontiguous physical RAM.)

0x00000070

The driver called MmProbeAndLockPages with IRQL > DISPATCH_LEVEL.

0x00000071

The driver called MmProbeAndLockProcessPages with IRQL > DISPATCH_LEVEL.

0x00000072

The driver called MmProbeAndLockSelectedPages with IRQL > DISPATCH_LEVEL.

0x00000073

The driver called MmMapIoSpace with IRQL > DISPATCH_LEVEL.

0x00000074

The driver called MmMapLockedPages in kernel mode with IRQL > DISPATCH_LEVEL.

0x00000075

The driver called MmMapLockedPages in user mode with IRQL > APC_LEVEL.

0x00000076

The driver called MmMapLockedPagesSpecifyCache in kernel mode with IRQL > DISPATCH_LEVEL.

0x00000077

The driver called MmMapLockedPagesSpecifyCache in user mode with IRQL > APC_LEVEL.

0x00000078

The driver called MmUnlockPages with IRQL > DISPATCH_LEVEL.

0x00000079

The driver called MmUnmapLockedPages in kernel mode with IRQL > DISPATCH_LEVEL.

0x0000007A

The driver called MmUnmapLockedPages in user mode with IRQL > APC_LEVEL.

0x0000007B

The driver called MmUnmapIoSpace with IRQL > APC_LEVEL.

0x0000007C

The driver called MmUnlockPages, and passed an MDL whose pages were never successfully locked.

0x0000007D

The driver called MmUnlockPages, and passed an MDL whose pages are from nonpaged pool (These should never be unlocked.)

0x00000080

The driver called KeSetEvent with IRQL > DISPATCH_LEVEL.

0x00000081

The driver called MmMapLockedPages (You should use MmMapLockedPagesSpecifyCache instead, with the BugCheckOnFailure Parameter set to FALSE.)

0x00000082

The driver called MmMapLockedPagesSpecifyCache with the BugCheckOnFailure Parameter equal to TRUE (This Parameter should be set to FALSE.)

0x00000083

The driver called MmMapIoSpace without having locked down the MDL pages. The physical pages represented by the physical address range being mapped must have been locked down prior to making this call.

0x00000084

The driver called MmMapIoSpace without having locked down the MDL pages (or after freeing the MDL pages).

0x00000085

The driver called MmMapLockedPages without having locked down the MDL pages.

0x00000086

The driver called MmMapLockedPages without having locked down the MDL pages (or after freeing the MDL pages).

0x00000087

The driver called MmMapIoSpace, but the caller's cache type conflicts with an existing mapping.

0x00000088

The driver called MmMapIoSpace to map a physical range as non-cached or write-combined, but the caller's physical range already has an existing cached mapping.

0x00000089

An MDL is not marked as "I/O", but it contains non-memory page addresses.

0x0000008A

The driver called MmMapLockedPagesXxx to map a physical range as non-cached or write-combined, but the caller's physical range already has an existing cached mapping.

0x00000090

2003-

The driver switched stacks, and the current stack is neither a thread stack nor a DPC stack
(Typically, the driver doing this should be on the stack obtained by using the kb (Display Stack Backtrace) debugger command.)

0x00000091

The driver switched stacks using a method that is not supported by the operating system. The only supported way to extend a kernel mode stack is by using KeExpandKernelStackAndCallout.

0x000000A0

2003+

A cyclic redundancy check (CRC) error was detected on a hard disk. A bug check with this Parameter occurs only when the Disk Integrity Checking option of Driver Verifier is active.

0x000000A1

2003+

A CRC error was detected on a sector (asynchronously). A bug check with this Parameter occurs only when the Disk Integrity Checking option of Driver Verifier is active.

0x000000A2

2003+

The CRCDISK checksum copies don't match. This could be a paging error. A bug check with this Parameter occurs only when the Disk Integrity Checking option of Driver Verifier is active.

0x000000B0

Vista+

The driver called MmProbeAndLockPages for an MDL with incorrect flags. For example, the driver passed an MDL created by MmBuildMdlForNonPagedPool to MmProbeAndLockPages.

0x000000B1

Vista+

The driver called MmProbeAndLockProcessPages for an MDL with incorrect flags. For example, the driver passed an MDL created by MmBuildMdlForNonPagedPool to MmProbeAndLockProcessPages.

0x000000B2

Vista+

The driver called MmMapLockedPages for an MDL with incorrect flags. For example, the driver passed an MDL that is already mapped to a system address or that was not locked to MmMapLockedPages.

0x000000B3

Vista+

The driver called MmMapLockedPages for an MDL with incorrect flags. For example, the driver passed an MDL that is not locked to MmMapLockedPages.

0x000000B4

Vista+

The driver called MmUnlockPages for a partial MDL. A partial MDL is one that was created by IoBuildPartialMdl.

0x000000B5

Vista+

The driver called MmUnmapLockedPages for a partial MDL. A partial MDL is one that was created by IoBuildPartialMdl.

0x000000B6

Vista+

The driver called MmUnmapLockedPages for an MDL that is not mapped to a system address.

0x000000B7

Vista+

The system BIOS has corrupted low physical memory during a sleep transition.

0x000000C0

Vista+

The driver called IoCallDriver with interrupts disabled.

0x000000C1

Vista+

A driver dispatch routine was returned with interrupts disabled.

0x000000C2

Vista+

The driver called a Fast I/O dispatch routine after interrupts were disabled.

0x000000C3

Vista+

A driver Fast I/O dispatch routine was returned with interrupts disabled.

0x000000C5

Vista+

A driver dispatch routine has changed the thread APC disable count. The APC disable count is decremented each time a driver calls KeEnterCriticalRegion, KeInitializeMutex, or FsRtlEnterFileSystem. The APC disable count is incremented each time a driver calls KeLeaveCriticalRegion, KeReleaseMutex, or FsRtlExitFileSystem. Because these calls should always be in pairs, this value should be zero whenever a thread is exited. A negative value indicates that a driver has disabled APC calls without re-enabling them. A positive value indicates that the reverse is true.

0x000000C6

Vista+

A driver Fast I/O dispatch routine has changed the thread APC disable count. The APC disable count is decremented each time a driver calls KeEnterCriticalRegion, KeInitializeMutex, or FsRtlEnterFileSystem. The APC disable count is incremented each time a driver calls KeLeaveCriticalRegion, KeReleaseMutex, or FsRtlExitFileSystem. Because these calls should always be in pairs, this value should be zero whenever a thread is exited. A negative value indicates that a driver has disabled APC calls without re-enabling them. A positive value indicates that the reverse is true.

0x000000CA

Vista+

The driver has attempted to re-initialize a lookaside list.

0x000000CB

Vista+

The driver has attempted to delete an uninitialized lookaside list.

0x000000CC

Vista+

The driver has attempted to free a pool allocation that contains an active lookaside list.

0x000000CD

Vista+

The driver has attempted to create a lookaside list with an allocation block size that is too small.

0x000000D0

Vista+

The driver has attempted to re-initialize an ERESOURCE structure.

0x000000D1

Vista+

The driver has attempted to delete an uninitialized ERESOURCE structure.

0x000000D2

Vista+

The driver has attempted to free a pool allocation that contains an active ERESOURCE structure.

0x000000D5

Vista+

The current IoReleaseRemoveLock tag does not match the previous IoAcquireRemoveLock tag. If the driver calling IoReleaseRemoveLock is not in a checked build, Parameter 2 is the address of the shadow IO_REMOVE_LOCK structure created by Driver Verifier on behalf of the driver. In this case, the address of the IO_REMOVE_LOCK structure used by the driver is not used at all, because Driver Verifier is replacing the lock address for all the remove lock APIs. A bug check with this Parameter occurs only when the I/O Verification option of Driver Verifier is active.

0x000000D6

Vista+

The current IoReleaseRemoveLockAndWait tag does not match the previous IoAcquireRemoveLock tag. If the driver calling IoReleaseRemoveLock is not a checked build, Parameter 2 is the address of the shadow IO_REMOVE_LOCK structure created by Driver Verifier on behalf of the driver. In this case, the address of the IO_REMOVE_LOCK structure used by the driver is not used at all, because Driver Verifier is replacing the lock address for all the remove lock APIs. A bug check with this Parameter occurs only when the I/O Verification option of Driver Verifier is active.

0x000000DA

Vista+

An attempt was made to unload a driver that has not deregistered its WMI callback function.

0x000000DB

Vista+

An attempt was made to delete a device object that was not deregistered from WMI.

0x000000DC

Vista+

An invalid RegHandle value was specified as a Parameter of the function EtwUnregister.

0x000000DD

Vista+

An attempt was made to unload a driver without calling EtwUnregister.

0x000000E0

Vista+

A call was made to an operating system Kernel function that specified a user-mode address as a Parameter.

0x000000E1

Vista+

A synchronization object was found to have an address that was either invalid or pageable.

0x000000E2

Vista+

An IRP with Irp->RequestorMode set to KernelMode was found to have a user-mode address as one of its members.

0x000000E3

Vista+

A driver has made a call to a kernel-mode ZwXxx routine with a user-mode address as a Parameter.

0x000000E4

Vista+

A driver has made a call to a kernel-mode ZwXxx routine with a malformed UNICODE_STRING structure as a Parameter.

0x000000E5

Vista+

A call was made to a Kernel API at the incorrect IRQL.

0x000000EA

Vista+

A driver has attempted to acquire a pushlock while APCs are enabled.

0x000000EB

Vista+

A driver has attempted to release a pushlock while APCs are enabled.

0x000000F0

Vista+

A driver called the memcpy function with overlapping source and destination buffers.

0x000000F5

Vista+

A driver passed a NULL handle to ObReferenceObjectByHandle.

0x00001000

XP+

Self-deadlock: The current thread has tried to recursively acquire a resource. A bug check with this Parameter occurs only when the Deadlock Detection option of Driver Verifier is active.

0x00001001

XP+

Deadlock: A lock hierarchy violation has been found. A bug check with this Parameter occurs only when the Deadlock Detection option of Driver Verifier is active
(Use the !deadlock debugger extension for further information.)

0x00001002

XP+

Uninitialized resource: A resource has been acquired without having been initialized first. A bug check with this Parameter occurs only when the Deadlock Detection option of Driver Verifier is active.

0x00001003

XP+

Unexpected release: A resource has been released out of the proper order. A bug check with this Parameter occurs only when the Deadlock Detection option of Driver Verifier is active.

0x00001004

XP+

Unexpected thread: The wrong thread is releasing a resource. A bug check with this Parameter occurs only when the Deadlock Detection option of Driver Verifier is active.

0x00001005

XP+

Multiple initialization: A resource is being initialized more than once. A bug check with this Parameter occurs only when the Deadlock Detection option of Driver Verifier is active.

0x00001006

XP+

Thread holds resources: A thread is being deleted without first releasing its resources. A bug check with this Parameter occurs only when the Deadlock Detection option of Driver Verifier is active.

0x00001007

XP+

Unacquired resource: A resource is being released without having first been acquired. A bug check with this Parameter occurs only when the Deadlock Detection option of Driver Verifier is active.

While BSoD fatal stop errors are identified by Microsoft Windows, they are often caused by
non-Microsoft applications, drivers and hardware issues.

Research this Issue

Getting search results...

Notes

While we believe this information up to date and accurate, FAQware is not responsible for any inaccuracies. If you find something that is out of date or inaccurate, please let us know at
so we can correct it.